Fake App Attack

I'm using SEP 12.1.4013 on Windows XP Pro. A user in the office got the following pop up message right above SEP icon in the system tray:

Symantec Endpoint Protection
[SID: 24300] Fake App Attack: Fake AV Website 20 detected

The user said he closed all IE8 windows by clicking "End Task" button in the Task Manager. Did SEP12 intercept and protect the computer or is it infected? I'm scanning the computer at the moment.